Description
Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build.
Remediation
References
https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2794
Related Vulnerabilities
CVE-2020-2139 Vulnerability in maven package org.jenkins-ci.plugins:cobertura
CVE-2020-6462 Vulnerability in npm package electron
CVE-2021-21349 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2023-24435 Vulnerability in maven package org.jenkins-ci.plugins:ghprb
CVE-2020-1941 Vulnerability in maven package org.apache.activemq:activemq-web-console